Re: [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time

Binbin Wu
2025-08-27T01:41:21Z

On 8/27/2025 9:17 AM, Sagi Shahar wrote:
> TDX module protects the EOI-bitmap which prevents the use of in-kernel
> I/O APIC. See more details in the original patch [1]
>
> The current implementation already enforces the use of split irqchip for
> TDX but it does so at the vCPU creation time which is generally to late
to late -> too late

> to fallback to split irqchip.
>
> This patch follows Sean's recomendation from [2] and move the check if
recomendation -> recommendation

Also "move the check ..." needs to be updated, since the check during vCPU
creation is still there.

> I/O APIC is supported for the VM at irqchip creation time.

Some nits above.

Otherwise,
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>

>
> [1] https://lore.kernel.org/lkml/20250222014757.897978-11-binbin.wu@linux.intel.com/
> [2] https://lore.kernel.org/lkml/aK3vZ5HuKKeFuuM4@google.com/
>
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Sagi Shahar <sagis@google.com>
> ---
> arch/x86/include/asm/kvm_host.h | 1 +
> arch/x86/kvm/vmx/tdx.c | 6 ++++++
> arch/x86/kvm/x86.c | 9 +++++++++
> 3 files changed, 16 insertions(+)
>
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index f19a76d3ca0e..6a4019d3a184 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -1357,6 +1357,7 @@ struct kvm_arch {
> u8 vm_type;
> bool has_private_mem;
> bool has_protected_state;
> + bool has_protected_eoi;
> bool pre_fault_allowed;
> struct hlist_head *mmu_page_hash;
> struct list_head active_mmu_pages;
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 66744f5768c8..9637d9da1af1 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -658,6 +658,12 @@ int tdx_vm_init(struct kvm *kvm)
> */
> kvm->max_vcpus = min_t(int, kvm->max_vcpus, num_present_cpus());
>
> + /*
> + * TDX Module doesn't allow the hypervisor to modify the EOI-bitmap,
> + * i.e. all EOIs are accelerated and never trigger exits.
> + */
> + kvm->arch.has_protected_eoi = true;
> +
> kvm_tdx->state = TD_STATE_UNINITIALIZED;
>
> return 0;
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index a1c49bc681c4..57b4d5ba2568 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6966,6 +6966,15 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
> if (irqchip_in_kernel(kvm))
> goto create_irqchip_unlock;
>
> + /*
> + * Disallow an in-kernel I/O APIC if the VM has protected EOIs,
> + * i.e. if KVM can't intercept EOIs and thus can't properly
> + * emulate level-triggered interrupts.
> + */
> + r = -ENOTTY;
> + if (kvm->arch.has_protected_eoi)
> + goto create_irqchip_unlock;
> +
> r = -EINVAL;
> if (kvm->created_vcpus)
> goto create_irqchip_unlock;